MAL-2026-12727

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-nx-spa/MAL-2026-12727.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12727
Published
2026-08-05T13:49:07Z
Modified
2026-08-05T14:36:44.253368245Z
Summary
Malicious code in devplatform-nx-spa (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740)

On require of the package, index.js loads support.js, whose top-level init() selects a platform-specific asset, downloads a native binary from one of four Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev through cf103), and falls back to reconstructing the binary from base64-encoded DNS TXT records under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) when HTTPS fails. The fetched bytes are written to /var/tmp (POSIX) or %TEMP% (Windows) under a cover filename ('dotnetdiag<rand>.exe' or '.cache<rand>'), chmod 0755'd on POSIX, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames are assembled at runtime via.join("") on split string literals to evade static analysis, and a state file named '.analytics_state' is used as cover. A sibling lib/telemetry.js is unreferenced in this version but reimplements the same drop-and-exec primitives behind an 'analytics SDK' framing.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:49:07Z",
            "source": "amazon-inspector",
            "sha256": "b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740",
            "import_time": "2026-08-05T14:19:56.841250599Z",
            "id": "IN-MAL-2026-015051",
            "versions": [
                "35.8.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-nx-spa

Package

Name
devplatform-nx-spa
View open source insights on deps.dev
Purl
pkg:npm/devplatform-nx-spa

Affected ranges

Affected versions

35.*
35.8.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-nx-spa-35.8.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-JVOHwsPMXtTQPKP+vG8mL1uhzxqjDxSEHYP2QNc9pIunT/4liA4jeVqGnSITh5zzCpcCzECXq1aDcl4pmDkCig==",
                "sha1": "67a3a762a78881e03fd6ed51c2a6579b1c371297"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "2aa1745a166a70084b70e7e4c61b4416f66af66333809695f79c69881fb2534c3b2ffc",
            "sha256": "ea3a098794b789b4427bae51db20d6700c7212627da83816978b52d602a041c9",
            "path": "_support.js"
        },
        {
            "tlsh": "41835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "80be5202c07d273813f5b70ce84e1e158d9e899aa18d874da374403f6567eefd",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-nx-spa/MAL-2026-12727.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]